Pushing a virtual desktop session from an authenticated device using image scanning

ABSTRACT

Image scanning and encoding technologies can be utilized to authenticate devices to virtual desktops and to transfer virtual desktop sessions between devices. One device (e.g., PC or laptop) may encode certain information into an image that is displayed on a display screen, while another mobile device equipped with a digital camera (e.g., mobile phone or tablet) can be used to scan the image on the display screen. Once the image is scanned, it can be decoded by the mobile device to get the information encoded in the image (e.g., device ID, session ID, etc.). The information obtained from the image can be used to authenticate a device or to transfer a virtual desktop session between the devices.

RELATED APPLICATIONS

This application is related to U.S. patent application Ser. No.XX/XXX,XXX, entitled “ACCESSING VIRTUAL DESKTOPS VIA IMAGE SCANNING” byHaiou Jiang et al., filed on the same date as the present application,which is incorporated by reference in its entirety herein.

TECHNICAL FIELD

The present disclosure generally relates to virtual desktop environmentsand more particularly relates to authenticating virtual desktops andtransferring virtual desktop sessions based on image scanning.

BACKGROUND

With the rising popularity of cloud computing, virtual desktopenvironments, such as those based on Virtual Desktop Infrastructure(VDI) and Desktop-as-a-Service (DAAS) have become rapidly growingindustries. In a conventional VDI or DAAS environment, a user isprovisioned a virtual desktop and is allowed to access their virtualdesktop over a remote network connection, such as a WAN connection. Thevirtual desktops are typically hosted on servers that reside in a datacenter of the enterprise (or a third party service provider), and eachhost server may execute multiple virtual desktops. Users can utilize aclient device to remotely log into their individual virtual desktop andall of the application execution takes place on the remote host serverwhich is linked to the local client device over a network, using aremote display protocol such as remote desktop protocol (RDP),PC-over-IP protocol, virtual network computing (VNC) protocol, or thelike. Using such a remote desktop protocol, the user can interact withapplications of the virtual desktop, which are running on the remotehost server, such that only the display, keyboard, and mouse informationis communicated with the local client device. A common implementation ofthis approach is to host multiple desktop operating system instances ona server hardware platform running a hypervisor.

In many ways, VDI and DAAS provide a more centralized and efficientcomputing environment because each user is able to access theirindividual desktop from any device capable of making a networkconnection and from virtually any location. All of the user data isstored in the cloud (e.g., in a data center), providing more centralizedmanagement and quality of control for the organization that may employthe individual users.

However, a number of inconveniences and other issues remain in thecontext of virtual desktop environments. One form of inconvenience stemsfrom the fact that users frequently utilize a variety of devices toremotely access their individual virtual desktop. For example,throughout the day a single user may log into their virtual desktopusing a personal computer (PC), a laptop, a tablet computer and a mobilephone. Conventionally, the user would need to enter a username andpassword each time that he or she wishes to log into their virtualdesktop. Moreover, when changing devices, the user would typically logout of the virtual desktop of one device only to log into the desktopusing a different devices, sometimes losing any state information (e.g.,open applications, etc.) and potentially data that was not saved beforelogging out.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example of a virtual desktop infrastructure (VDI)environment, in accordance with various embodiments;

FIG. 2 illustrates an example of using image scanning to authenticatedevices to virtual desktops or transfer virtual desktop sessions betweendevices, in accordance with various embodiments;

FIG. 3 illustrates an example of migrating a virtual desktop sessionfrom an authenticated computing device to an unauthenticated mobiledevice via image scan, in accordance with various embodiments;

FIG. 4 illustrates an example of pushing a virtual desktop session froman authenticated mobile device to an unauthenticated computer, inaccordance with various embodiments;

FIG. 5 illustrates an example of a process for migrating a session froman authenticated computer to an unauthenticated mobile device equippedwith a digital camera, in accordance with various embodiments;

FIG. 6 illustrates an example of a process for pushing a virtual desktopsession from an authenticated mobile device equipped with a camera to anunauthenticated computing device, in accordance with variousembodiments;

FIG. 7 illustrates an example of some general components of a computingdevice, in accordance with various embodiments.

DETAILED DESCRIPTION

Systems and methods in accordance with various embodiments of thepresent disclosure overcome at least some of the above mentionedshortcomings and deficiencies by providing more efficient ways to accessvirtual desktops from various devices. In particular, embodimentsdescribed herein utilize image scanning and encoding technologies, suchas Quick Response (QR) codes in order to authenticate devices to virtualdesktops and to transfer virtual desktop sessions between devices. Invarious embodiments, one device (e.g., PC or laptop) may encode certaininformation into an image that is displayed on a display screen, whileanother mobile device equipped with a digital camera (e.g., mobile phoneor tablet) can be used to scan the image on the display screen. Once theimage is scanned, it can be decoded by the mobile device to get theinformation encoded in the image (e.g., device ID, session ID, etc.).The information obtained from the image can be used to authenticate adevice or to transfer a virtual desktop session between the devices. Forexample, in some embodiments, the virtual desktop session can be pulledfrom an authenticated computer (e.g., PC) to an unauthenticated mobiledevice by scanning the image. In other embodiments, the virtual desktopsession can be pushed from an authenticated mobile device to anunauthenticated computer by scanning the image. In many embodiments, theinformation encoded in the image can be encrypted in order to preventunwanted users from scanning the image and gaining access to theinformation.

As used herein, the terms “virtual desktop” and “desktop” are usedinterchangeably and refer to an instance of an operating system orapplication that runs remotely with respect to the user. In aconventional VDI or DAAS environment, each virtual desktop correspondsto a virtual machine (VM) executed on a host server (i.e., a hostcomputing device) that is physically located in a remote datacenter.Each host server may host any number of virtual machines (e.g., tens,hundreds, etc.) and each virtual machine may be owned by an individualuser. The virtual machine typically includes a guest operating system(e.g., Windows) capable of executing applications for the user and thevirtual machine is used to provide a virtual desktop for the individualuser. The user that owns the virtual desktop can remotely log into theirvirtual desktop using a client device that establishes a networkconnection (e.g., Wide Area Network connection) with the host server andremotely execute various applications on the virtual machine as if thedesktop was running on the user's local client device. The client devicecan be any computing device capable of establishing a networkconnection, including but not limited to personal computers (PCs),laptops, mobile phones, tablet computers, wearable devices (e.g., smartwatches, electronic smart glasses, etc.) or the like.

In one embodiment, a virtual desktop session can be pulled or migratedfrom an authenticated computer client device to an unauthenticatedmobile device equipped with a digital camera. For example, a user may belogged into their individual virtual desktop using a personal computer(PC). When the user is logged in, the virtual desktop client applicationon the computer has established a session with the virtual desktopexecuting on a remote server. At some point, the user may wish totransfer the virtual desktop session from the computer to their mobiledevice (e.g., take their session “on the go” when leaving the house). Inorder to transfer the session, the authenticated computer may display animage, such as a QR code, that is encoded with information used tomigrate the session to another device. For example, the information mayinclude a unique session identifier (ID) which the mobile device can useto establish a connection with a broker. Once the QR code is displayed,the mobile device can use its digital camera to capture the image of theQR code and decode the information therein. In some embodiments, theinformation may be encrypted by the computer using a cryptographic keybefore encoding the information into the image. At the time ofdisplaying the image, the computer may upload the cryptographic key tothe broker. The mobile device may then scan the image, get the encryptedinformation and then contact the broker to obtain the cryptographic key.The broker can verify that the mobile device is permitted to access thevirtual desktop (e.g., by checking a whitelist of devices) and returnthe cryptographic key to the mobile device if it passes verification.The mobile device may then use the key to decrypt the informationencoded in the image to get the session ID and use the session ID toestablish the virtual desktop session. In at least some embodiments, thesession ID of the authenticated PC will be used to request the broker toclone another session for the mobile device without requiring anyinputting of credentials. In this case, the cloned session for themobile device would be associated with a new session ID that isdifferent from the original session ID of the PC.

In another embodiment, the virtual desktop session may be pushed ormigrated from an authenticated mobile device to an unauthenticatedcomputer. For example, a user may be logged into their individualvirtual desktop using a mobile device, such as a phone or tablet that isalso equipped with a digital camera. In this case, the mobile device isauthenticated since it has an established virtual desktop session. Anunauthenticated computer (e.g., PC or laptop) has requested a serverconnection (e.g., from the broker) and is displaying an image (e.g., QRcode) on its display screen, for example on a login page of the virtualdesktop client application. This makes it possible for the broker tolocate the client connection and then inform the client to authenticatewithout credentials. The QR code contains information identifying thecomputer that has not yet been authenticated. For example, the QR codemay be encoded with a unique device ID associated with the computer, anInternet Protocol (IP) address of the computer, an IP address of aconnection broker, and/or a unique client ID associated with the virtualdesktop client application. The mobile device can scan the QR code, getthe information identifying the unauthenticated computer and contact thebroker to establish the connection. Since the mobile client device hasbeen authenticated, it is able to directly send requests to the broker.The mobile client device can send the session ID of its current sessionand other necessary information for broker's verification, including theclient ID and the device ID of the unauthenticated computer. It can alsosend the IP address of the unauthenticated computer to the broker. Thebroker will check whether the client ID and device ID are entitled tothis functionality (e.g., determine whether the unauthenticated computeris on a whitelist of devices permitted to access the virtual desktop).If the computer passes the verification, the broker will send thatmessage to the computer to inform the client to start a connection.

In yet other embodiments, the virtual desktop session can be migratedbetween multiple mobile devices (e.g., from one mobile phone to anothermobile phone) or between multiple computers (e.g., from one laptop toanother or from one PC to another). Because mobile devices are typicallyequipped with a digital camera, the virtual desktop session can bemigrated between two mobile phones using either technique describedabove. Similarly, some laptops and personal computers are also equippedwith digital cameras and the embodiments described herein are equallyapplicable to such devices.

FIG. 1 illustrates an example of a virtual desktop environment, inaccordance with various embodiments. The virtual desktop environment,such as VDI or DAAS environment, includes host servers (102-1, 102-2,102-N) that are communicatively coupled with a number of client devices(120-1, 120-2, 120-N) via a network 106. Network 106 may be a local areanetwork (LAN), wide area network (WAN) or other form of remotecommunication link between the host servers (102-1, 102-2, 102-N) andclient devices (120-1, 120-2, 120-N). Network 106 may further includenumerous other components, such as one or more firewalls, connectionbrokers, management servers, etc., which are not shown here so as to notobscure salient features of the VDI environment. Host servers (102-1,102-2, 102-N) may physically reside in a data center 101 of theenterprise (e.g., in case of VDI) or in a data center of a third partyservice provider (e.g., in case of DAAS).

By way of illustration, host server 102-1 can interoperate with clientdevices (120-1, 120-2, 120-N) to provide virtual desktop services tousers of client devices (120-1, 120-2, 120-N). For example, host server102-1 can host, for each user, a desktop that is presented by a guestoperating system (such as one of the guest operating systems 105-1,105-2, 105-N) running on a virtual machine (such as one of the virtualmachines 110-1, 110-2, 110-N) on host server 102. In this context, theterm “desktop” refers to a computing environment in which a user canlaunch, interact with, and manage the user's applications, settings, anddata. Each client device (120-1, 120-2, 120-N) can allow a user to viewon a desktop graphical user interface (on a local display device)his/her desktop that is running remotely on host server 102-1, as wellas provide commands for controlling the desktop. In this manner, theusers of client devices (e.g., 120-1, 120-2, 120-N) can interact withthe desktops hosted on host server 102-1 as if the desktops wereexecuting locally on client devices (120-1, 120-2, 120-N).

In the embodiment of FIG. 1, host server 102-1 includes virtualizationsoftware 104 that supports the execution of one or more virtual machines(VMs) (e.g., 110-1, 110-2, 110-N). The virtualization software 104 maybe a hypervisor, a virtual machine manager (VMM) or other software thatallows multiple virtual machines to share the physical resources of theserver. In the illustrated embodiment, each virtual machine (e.g.,110-1, 110-2, 110-N) can execute a guest operating system (e.g., 105-1,105-2, 105-N) that hosts a desktop for a single user at a time. Forexample, if five users connect to host server 102-1 for the purpose ofinitiating remote desktop sessions, the host server 102-1 can launchfive VMs, each hosting one desktop for each one of the five users. Thesetypes of virtual desktop environments where user desktops are hostedwithin separate, server-side virtual machines are often referred to asvirtual desktop infrastructure (VDI) or Desktop-as-a-Service (DAAS)environments.

In such virtual desktop environments, each client device (e.g., 120-1,120-2, 120-N) can execute a virtual desktop client application (e.g.,122-1, 122-2, 122-N). The interaction between the virtual desktop andthe client device can be facilitated by such a virtual desktop client(e.g., 122-1, 122-2, 122-N) running in the OS (e.g., 121-1, 121-2,121-N) on the client device (e.g., 120-1, 120-2, 120-N) whichcommunicates with a server-side virtual desktop agent (e.g., 103-1,103-2, 103-N) that is running on the guest OS inside the virtual machine(e.g., 110-1, 110-2, 110-N). In particular, the interaction can beperformed by the virtual desktop agent transmitting visual displayinformation (e.g., framebuffer data) over the network to the virtualdesktop client and the virtual desktop client in turn transmitting userinput events (e.g., keyboard, mouse events) to the remote desktop agent.

It should be noted that the particular virtual desktop environmentillustrated in FIG. 1 is shown purely for purposes of illustration andis not intended to be in any way inclusive or limiting to theembodiments that are described herein. For example, a typical enterpriseVDI deployment would include many more host servers which may bedistributed over multiple data centers, which might include many othertypes of devices, such as switches, power supplies, cooling systems,environmental controls, and the like, which are not illustrated herein.Similarly, a single host server would typically host many more virtualmachines than what is shown in this illustration. It will be apparent toone of ordinary skill in the art that the example shown in FIG. 1, aswell as all other figures in this disclosure have been simplified forease of understanding and are not intended to be exhaustive or limitingto the scope of the invention.

FIG. 2 illustrates an example of using image scanning to authenticatedevices to virtual desktops or transfer virtual desktop sessions betweendevices, in accordance with various embodiments. As shown in thisexample, a PC client device 206 can display an image, in this case aQuick Response (QR) code 202 on the display screen. A QR code is a typeof well-known matrix barcode (or two-dimensional barcode) which wasfirst designed for the automotive industry in Japan. The QR code is amachine-readable optical label that contains information about the itemto which it is attached. The QR code encodes data into an image whichcan be read by another machine. In various embodiments described herein,the QR code can be used to transmit data from one device to another.

In various embodiments, the QR code 202 can be displayed on the displayscreen of a client device (e.g., a PC, laptop, tablet, mobile phone,etc.) and be encoded with information that is used to authenticate adevice to a virtual desktop or to transfer a virtual desktop sessionfrom one device to another. The QR code may be displayed by a virtualdesktop client application running on the device at any number ofdifferent locations or times. For example, in some embodiments, the QRcode may be displayed on the login page of the virtual desktop clientapplication. In other embodiments, the QR code may be displayed on thecorner of the desktop screen of the virtual desktop. Furthermore, the QRcode may be displayed permanently or at selected times, such as inresponse to the user requesting the QR code to be displayed.

In some embodiments, the QR code 202 may be displayed within the windowsof certain applications. This may be useful in the context ofapplication remoting, i.e., in cases when only certain applications areremoted from the host server to the client device, rather than theentire desktop of the user. In those cases, the QR code can be used totransfer the session of the application between devices rather than theentire desktop session.

The QR code 202 can be encoded with many different types of informationthat may be used to authenticate devices or transfer virtual desktopsessions between devices. By way of example, the QR code may be encodedwith unique device IDs, unique client IDs, unique session IDs, and/or IPaddresses, among other types of information. The QR code is encoded withthe information by the PC client device 206 using QR code generatorsoftware, such as QRencoder. Once displayed, the QR code may be capturedusing a digital camera 204 of a mobile device 203. For example, the usermay start the camera viewer application on the mobile device 203 and aimthe camera 204 of the mobile device 203 at the QR code in order to placethe QR code within the field of view (FOV) of the digital camera 204 andto enable the mobile device to scan the QR code 205. The mobile device203 may contain barcode reader software to scan the QR code and todecode the information encoded therein. One example of such a barcodereader software is Zbar which is a C barcode reading library with C++,Python, Perl, and Ruby bindings.

In certain embodiments, the information encoded in the QR code may beencrypted using a cryptographic key. For example, it may be desirable toprevent any unwanted user in the vicinity that may have a device with QRdecoding capability from gaining access to the information (e.g.,snapping a picture of the QR code over the shoulder of the user). Manydifferent encryption schemes can be utilized to encrypt the information,including symmetric or asymmetric forms of encryption. The PC clientdevice 206 may encrypt the information prior to encoding the informationinto the QR code 202. Once the information has been encrypted, the PCclient device 206 can transmit a decryption key to a remote connectionbroker. The mobile client device may then contact the connection brokerand verify its identity to the broker in order to get the key fordecrypting the information. In various embodiments, the cryptographickey is only effective during the current session and will be deleted bythe broker after the session is terminated by the user. If a user withanother device wants to get access to the session (or a cloned copy ofthe session), they would have to first scan the image and decode it toget the encrypted data. Then the client should send a message to brokerin order to request the key for decryption. The message contains theclient ID and the unique device ID. Broker would verify the requestbased on the client ID and the device ID. If the verification is passed,the broker could also inform the virtual desktop session which currentlyhas the active session to give the user an opportunity to confirm thesession access request. Only after the user confirms the request, thekey is sent to the second client device. After the data is correctlydecrypted, the second client can establish the connection to the broker.

In addition to (or instead of) encrypting the QR code, the lifetime ofthe QR code can be constrained to a limited time interval. For example,the QR code can be set to expire after 1 minute of display time, afterwhich it is no longer active. Alternatively, the QR code can beassociated with a maximum number of use times. For example, once the QRcode has been used to migrate a session, it may be disabled such that itcannot be reused by another device.

FIG. 3 illustrates an example of pulling a virtual desktop session froman authenticated computing device to an unauthenticated mobile devicevia image scan, in accordance with various embodiments. As previouslydiscussed, an authenticated computing device 301 having an establishedvirtual desktop session may display an image that is encoded withinformation that can be used to migrate the session from the computingdevice 301 to an unauthenticated mobile device 303. In the embodimentillustrated in this figure, the information contains the unique sessionID of the virtual desktop session established on the computing device301 and the information is encrypted by the computing device 301 priorto being encoded into the image.

As shown in the illustration, once the information has been encrypted,the computing device transmits the cryptographic key to a remoteconnection broker 302. In various embodiments, the broker 302 can belocated in a remote datacenter and it is responsible for authenticatingvarious devices and setting up virtual desktop sessions. In oneembodiment, the connection broker 302 is software running on a serverinside of the datacenter.

Once the image is displayed by the authenticated computing device 301,it can be scanned by the unauthenticated mobile device 303 to get theinformation encoded therein. Once the unauthenticated mobile device 303decodes the information from the image, it still needs the cryptographickey for decrypting the information. Thus, after scanning the image, themobile device 303 communicates with the connection broker 302 in orderto get the cryptographic key. The client on the mobile device 303 willsend its unique client ID and device ID to the broker 302 to request thekey used for decryption. The broker 302 can verify the request bychecking whether the mobile device 303 is listed on its whitelist ofdevices that are permitted to access the virtual desktop. The whitelistmay be preconfigured or set up by an administrator.

If the request passes the verification, the broker 302 sends a messageto the authenticated computing device 301 to inform it that anotherdevice is requesting to get the session. The user may then be providedwith an option to approve or deny that request. If the user confirms therequest, the broker 302 will provide the virtual desktop client on themobile device with the desired key. The mobile device 303 will thenestablish the session with the broker 302 using the decrypted data(which includes the session ID). For example, in one embodiment, themobile device may use the session ID retrieved from the image to requestthe broker 302 to clone a session for the mobile device withoutinputting any credentials by the user. This cloned session may beassociated with a new session ID, however, it would be a copy of thesession that was established on the authenticated computing device 301.Meanwhile, the former session on the computing device 301 will beterminated, as shown in the figure. After the process is completed, thesession on computing device 301 will be successfully migrated to themobile device 303.

It should be noted that FIG. 3 illustrates a scenario where the virtualdesktop on the computing device 301 has been authenticated and has anactive session, which is then migrated to the mobile device 303. Incases where the virtual desktop client on the computing device 301 hasbeen authenticated but has no active sessions, the client on the mobiledevice 303 will be authenticated automatically without actuallymigrating any session.

FIG. 4 illustrates an example of pushing a virtual desktop session froman authenticated mobile device to an unauthenticated computer, inaccordance with various embodiments. In this illustration it is assumedthat the computing device 401 is unauthenticated whereas there has beenan authenticated session established on the mobile device 403. In someembodiments, the precondition to pushing a virtual desktop session inthis way may be that the unauthenticated PC has requested a serverconnection and is displaying a login page (e.g., the page for enteringthe username/password) with a QR code thereon, which enables the brokerto locate the client connection and then inform the client thatauthenticating without credentials is possible.

In the illustrated embodiment, the unauthenticated computing device 401first communicates with the broker 402 to perform network addresstranslation (NAT) so that the connection from the client will be locatedby the broker 402 from its pending pool of connections to enableproactive notification from the broker 402. The virtual desktop clienton the unauthenticated computing device 401 then encodes the client ID,unique device ID and IP information into the image (e.g., QR code) anddisplays the image on the screen. For example, the image may bedisplayed on the login page of the virtual desktop client on thecomputing device 401 as an alternative option to use instead of manuallyentering a password when logging in.

When the mobile client 403 scans the image, it will obtain theinformation identifying the computing device 401. Since in this scenariothe mobile client 403 has already been authenticated, it is able todirectly send requests to the broker 402. The mobile client 403 sendsthe session ID and other necessary information for broker'sverification, including the client ID and the device ID of the computingdevice 401 which the mobile device obtained from scanning the image. Themobile device 403 can also send the IP address of the unauthenticatedcomputing device 401 to the broker 402. Broker 402 checks whether theclient ID and device ID are entitled for this functionality. Forexample, the broker 402 may determine (using the client ID and deviceID) whether the computing device 401 is on the whitelist of devices thatare permitted to access the virtual desktop. If the computing device 401passes the verification, the broker 402 will send the message to thecomputing device 401 to inform the virtual desktop client on thecomputing device 401 to start a connection.

As previously described, the information encoded in the image may beencrypted or simply left in unencrypted form. If the information is notencrypted, anyone scanning the image displayed by the virtual desktopclient could obtain the original data. In such cases, it may be usefulto end any unauthorized attempts at automatic authentication ormigration prior to any interaction with the broker. For example, supposea user uses an authenticated mobile phone to scan the QR code on anunauthenticated PC, and the mobile phone retrieves the IP address of thebroker from the image displayed on the PC. Before the communication withbroker is started, the virtual desktop client on the mobile phone shouldcheck whether the two broker IP addresses are the same, if they are,inform the broker to continue, otherwise an error message should beprompted and the connection should be terminated.

FIG. 5 illustrates an example of a process for pulling a session from anauthenticated computer to an unauthenticated mobile device equipped witha digital camera, in accordance with various embodiments. As shown inoperation 500, the authenticated device having an active virtual desktopsession displays an image (e.g., a QR code) on the display screen. Theimage has encoded information that can be used to transfer the activesession from the authenticated computing device to another device or tosimply authenticate another device. The image may be displayed anywhereon the display screen of the authenticated computer, such as in thecorner of the desktop screen or the like. In some embodiments, the imageis only displayed once the user requests the virtual desktop client todisplay the image.

In operation 501, an unauthenticated mobile device equipped with adigital camera scans the image that is displayed by the authenticatedcomputing device. In operation 502, the mobile device decodes theinformation encoded in the image to get the encrypted sessioninformation. Because the information is encrypted, the unauthenticatedmobile device contacts a remote connection broker, as shown in operation503. In one embodiment, the virtual desktop client on theunauthenticated mobile device provider its own unique client ID and thedevice ID of the mobile device to the broker. The broker uses thisinformation to verify that the mobile device is permitted to access thevirtual desktop and if verification is passed, the broker transmits thekey to the mobile device, as shown in operation 504. For example, thebroker may check a whitelist of permitted devices to determine verifythe mobile device.

In operation 505, the mobile device uses the key received from thebroker to decrypt the information encoded in the image. For example, thevirtual desktop client on the mobile device can decrypt the informationto get the unique session ID of the virtual desktop session establishedon the authenticated computing device which originally displayed theimage. The virtual desktop client on the mobile device then uses thedecrypted information to migrate the virtual desktop from the computingdevice to the mobile device.

FIG. 6 illustrates an example of a process for pushing a virtual desktopsession from an authenticated mobile device equipped with a camera to anunauthenticated computing device, in accordance with variousembodiments. As shown in operation 600, the unauthenticated computingdevice encodes information identifying itself into an image and displaysthe image on the display screen. For example, the unauthenticatedcomputing device may encode its IP address, device ID and the client IDof the virtual desktop client installed thereon.

In operation 601, a user on an authenticated mobile device uses thedevice to scan the image displayed by the unauthenticated computingdevice. The information may be in encrypted or unencrypted form. Inoperation 602, the mobile device decodes the image to get the identityinformation. In operation 603, the virtual desktop client on the mobiledevice sends the identity information to the broker, requesting thebroker to transfer the virtual desktop session to the unauthenticateddevice.

In operation 604, the connection broker verifies that theunauthenticated computing device is permitted to access the virtualdesktop, such as be checking a whitelist of permitted devices. If theunauthenticated computer is on the whitelist, the broker contacts thecomputing device and establishes a virtual desktop session thereon, asshown in operation 605.

FIG. 7 illustrates an example of some general components of a computingdevice, in accordance with various embodiments. In this particularexample, the device includes one or more processors (e.g., centralprocessing units (CPUs) 702 for executing instructions that can bestored in physical memory component 704. The memory component 704 caninclude many types of memory, data storage, or non-transitorycomputer-readable storage media, such as random access memory (RAM)storing program instructions for execution by the processor 702, aseparate form of storage for images or data, a removable memory forsharing information with other devices and the like. The computingdevice typically can further comprise a display component 706, such as amonitor, a touch screen, liquid crystal display (LCD), or the like. Invarious embodiments, the computing device will include at least oneinput device 708 able to receive conventional input from a user. Thisconventional input can include, for example, a push button, touch pad,touch screen, wheel, joystick, keyboard, mouse, keypad, or any othersuch device or element whereby a user can input a command to the device.In some embodiments, the computing device can include a networkinterface component (NIC) 708 for communicating over various networks,such as a Wi-Fi, Bluetooth, RF, wired, or wireless communicationsystems. The device in many embodiments can communicate over a network,such as the Internet, and may be able to communicate with other devicesconnected to the same or other network.

Various embodiments described herein can be implemented in a widevariety of environments, which in some cases can include one or moreuser computers, computing devices, or processing devices which can beused to operate any of a number of applications. User or client devicescan include any of a number of general purpose personal computers, suchas desktop or laptop computers running a standard operating system, aswell as cellular, wireless, and handheld devices running mobile softwareand capable of supporting a number of networking and messagingprotocols. Such a system also can include a number of workstationsrunning any of a variety of commercially-available operating systems andother known applications for purposes such as development and databasemanagement. These devices also can include other electronic devices,such as dummy terminals, thin-clients, gaming systems, and other devicescapable of communicating via a network.

Many embodiments utilize at least one network that would be familiar tothose skilled in the art for supporting communications using any of avariety of commercially-available protocols, such as TCP/IP, FTP, UDP orthe like. The network can be, for example, a local area network, awide-area network, a virtual private network, the Internet, an intranet,an extranet, a public switched telephone network, an infrared network, awireless network, and any combination thereof.

The various environments in which the embodiments can be implemented mayinclude a variety of data stores and other memory and storage media, asdiscussed above. These can reside in a variety of locations, such as ona storage medium local to one or more of the computers or remote fromany or all of the computers across the network. In some embodiments, theinformation may reside in a storage-area network (“SAN”) familiar tothose skilled in the art. Similarly, any necessary files for performingthe functions attributed to the computers, servers, or other networkdevices may be stored locally and/or remotely, as appropriate. Where asystem includes computerized devices, each such device can includehardware elements that may be electrically coupled via a bus, theelements including, for example, at least one central processing unit(CPU), at least one input device (e.g., a mouse, keyboard, controller,touch screen, or keypad), and at least one output device (e.g., adisplay device, printer, or speaker). Such a system may also include oneor more storage devices, such as disk drives, optical storage devices,and solid-state storage devices such as random access memory (“RAM”) orread-only memory (“ROM”), as well as removable media devices, memorycards, flash cards, etc.

Such devices also can include a computer-readable storage media reader,a communications device (e.g., a modem, a network card (wireless orwired), an infrared communication device, etc.), and working memory asdescribed above. The computer-readable storage media reader can beconnected with, or configured to receive, a computer-readable storagemedium, representing remote, local, fixed, and/or removable storagedevices as well as storage media for temporarily and/or more permanentlycontaining, storing, transmitting, and retrieving computer-readableinformation. The system and various devices also typically will includea number of software applications, modules, services, or other elementslocated within at least one working memory device, including anoperating system and application programs, such as a client applicationor Web browser. It should be appreciated that alternate embodiments mayhave numerous variations from that described above. For example,customized hardware might also be used and/or particular elements mightbe implemented in hardware, software (including portable software, suchas applets), or both. Further, connection to other computing devicessuch as network input/output devices may be employed.

Storage media and computer readable media for containing code, orportions of code, can include any appropriate media known or used in theart, including storage media and communication media, such as but notlimited to volatile and non-volatile, removable and non-removable mediaimplemented in any method or technology for storage and/or transmissionof information such as computer readable instructions, data structures,program modules, or other data, including RAM, ROM, EEPROM, flash memoryor other memory technology, CD-ROM, digital versatile disk (DVD) orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed by asystem device. Based on the disclosure and teachings provided herein, aperson of ordinary skill in the art will appreciate other ways and/ormethods to implement the various embodiments.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that various modifications and changes may be made thereuntowithout departing from the broader spirit and scope of the invention asset forth in the claims.

What is claimed is:
 1. A system for accessing a virtual desktop using image scanning, the system comprising: an unauthenticated computing device configured to display an image on a display screen, the image encoded with information identifying the computing device; and an authenticated mobile device having a virtual desktop session established thereon for accessing a virtual desktop, the authenticated device including a camera used to capture the image, the authenticated mobile device configured to: scan the image; decode the information identifying the computing device from the image; and transmit the information identifying the computing device and a session identifier of the virtual desktop session to a connection broker; and the connection broker configured to: receive the information identifying the computing device from the mobile device; authenticate the computing device based on the information identifying the computing device; and migrate the virtual desktop session from the mobile device to the computing device by using the session identifier.
 2. The system of claim 1, wherein the image is a Quick Response (QR) code displayed on a login page of a virtual desktop client application executing on the computing device.
 3. The system of claim 1, wherein the connection broker is further configured to store a white list containing information identifying each device that is permitted to access the virtual desktop.
 4. The system of claim 1, wherein the connection broker is further configured to terminate the virtual desktop session on the mobile device upon establishing the virtual desktop session on the computing device.
 5. The system of claim 1, wherein the information encoded in the image further comprises: a session identifier identifying the virtual desktop session established on the mobile device, an internet protocol (IP) address of a connection broker configured to establish a connection to the virtual desktop and a client identifier identifying a client application associated with the virtual desktop.
 6. The system of claim 5, wherein the mobile device is configured to read the IP address of the connection broker from the information encoded in the image and verify that the connection broker identified by the IP address corresponds to the same connection broker that was used to establish the virtual desktop session on the mobile device.
 7. A method for accessing a virtual desktop using image scanning, the method comprising: receiving, from a mobile device, information decoded by the mobile device from an image displayed on a display screen of a computing device and captured by a camera of the mobile device, the information identifying the computing device, wherein the mobile device has a virtual desktop session established to access a virtual desktop; authenticating the computing device using the information decoded from the image by the mobile device; and causing the virtual desktop session to be migrated from the mobile device to the computing device based on the information decoded from the image by the mobile device.
 8. The method of claim 7, wherein the information encoded in the image further comprises: a session identifier identifying the virtual desktop session established on the mobile device, an internet protocol (IP) address of a connection broker configured to establish a connection to the virtual desktop and a client identifier identifying a client application associated with the virtual desktop.
 9. The method of claim 8, wherein the mobile device is configured to read the IP address of the connection broker from the information encoded in the image and verify that the connection broker identified by the IP address corresponds to the same connection broker that was used to establish the virtual desktop session on the mobile device.
 10. The method of claim 7, wherein authenticating the computing device further comprises: determining whether the computing device is listed in a white list that identifies all devices permitted to access the virtual desktop.
 11. The method of claim 7, wherein the image is a Quick Response (QR) code displayed on a login page of a virtual desktop client application executing on the computing device.
 12. The method of claim 7, wherein the virtual desktop is provided on a virtual machine executing on a host server in a data center remotely located with respect to the mobile device and the computing device.
 13. The method of claim 7, further comprising: terminating the virtual desktop session on the mobile device upon establishing the virtual desktop session on the computing device.
 14. A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more processors to execute the operations of: receiving, from a mobile device, information decoded by the mobile device from an image displayed on a display screen of a computing device and captured by a camera of the mobile device, the information identifying the computing device, wherein the mobile device has a virtual desktop session established to access a virtual desktop; authenticating the computing device using the information decoded from the image by the mobile device; and causing the virtual desktop session to be migrated from the mobile device to the computing device based on the information decoded from the image by the mobile device.
 15. The non-transitory computer readable storage medium of claim 14, wherein the information encoded in the image further comprises: a session identifier identifying the virtual desktop session established on the mobile device, an internet protocol (IP) address of a connection broker configured to establish a connection to the virtual desktop and a client identifier identifying a client application associated with the virtual desktop.
 16. The non-transitory computer readable storage medium of claim 15, wherein the mobile device is configured to read the IP address of the connection broker from the information encoded in the image and verify that the connection broker identified by the IP address corresponds to the same connection broker that was used to establish the virtual desktop session on the mobile device.
 17. The non-transitory computer readable storage medium of claim 14, wherein authenticating the computing device further comprises: determining whether the computing device is listed in a white list that identifies all devices permitted to access the virtual desktop.
 18. The non-transitory computer readable storage medium of claim 14, wherein the image is a Quick Response (QR) code displayed on a login page of a virtual desktop client application executing on the computing device.
 19. The non-transitory computer readable storage medium of claim 14, wherein the virtual desktop is provided on a virtual machine executing on a host server in a data center remotely located with respect to the mobile device and the computing device.
 20. The non-transitory computer readable storage medium of claim 14, further comprising instructions that, when executed by one or more processors, cause the one or more processors to execute the operation of: terminating the virtual desktop session on the mobile device upon establishing the virtual desktop session on the computing device. 